innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Refs #32508 -- Raised TypeError/ValueError instead of using "assert" in encode() methods of remaining password hashers.

This commit is contained in:
Mateo Radman 2021-09-05 17:24:09 +02:00 committed by Mariusz Felisiak
parent e75a3a770e
commit a7f27fca52
2 changed files with 39 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
django/contrib/auth/hashers.py
View File

@ -689,7 +689,8 @@ class UnsaltedSHA1PasswordHasher(BasePasswordHasher):
return ''
def encode(self, password, salt):
assert salt == ''
if salt != '':
raise ValueError('salt must be empty.')
hash = hashlib.sha1(password.encode()).hexdigest()
return 'sha1$$%s' % hash
@ -733,7 +734,8 @@ class UnsaltedMD5PasswordHasher(BasePasswordHasher):
return ''
def encode(self, password, salt):
assert salt == ''
if salt != '':
raise ValueError('salt must be empty.')
return hashlib.md5(password.encode()).hexdigest()
def decode(self, encoded):
@ -774,9 +776,11 @@ class CryptPasswordHasher(BasePasswordHasher):
def encode(self, password, salt):
crypt = self._load_library()
assert len(salt) == 2
if len(salt) != 2:
raise ValueError('salt must be of length 2.')
hash = crypt.crypt(password, salt)
assert hash is not None # A platform like OpenBSD with a dummy crypt module.
if hash is None: # A platform like OpenBSD with a dummy crypt module.
raise TypeError('hash must be provided.')
# we don't need to store the salt, but Django used to do this
return '%s$%s$%s' % (self.algorithm, '', hash)

31
tests/auth_tests/test_hashers.py
View File

@ -143,6 +143,13 @@ class TestUtilsHashPass(SimpleTestCase):
self.assertTrue(check_password('', blank_encoded))
self.assertFalse(check_password(' ', blank_encoded))
@override_settings(PASSWORD_HASHERS=['django.contrib.auth.hashers.UnsaltedMD5PasswordHasher'])
def test_unsalted_md5_encode_invalid_salt(self):
hasher = get_hasher('unsalted_md5')
msg = 'salt must be empty.'
with self.assertRaisesMessage(ValueError, msg):
hasher.encode('password', salt='salt')
@override_settings(PASSWORD_HASHERS=['django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher'])
def test_unsalted_sha1(self):
encoded = make_password('lètmein', '', 'unsalted_sha1')
@ -161,6 +168,13 @@ class TestUtilsHashPass(SimpleTestCase):
self.assertTrue(check_password('', blank_encoded))
self.assertFalse(check_password(' ', blank_encoded))
@override_settings(PASSWORD_HASHERS=['django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher'])
def test_unsalted_sha1_encode_invalid_salt(self):
hasher = get_hasher('unsalted_sha1')
msg = 'salt must be empty.'
with self.assertRaisesMessage(ValueError, msg):
hasher.encode('password', salt='salt')
@skipUnless(crypt, "no crypt module to generate password.")
@override_settings(PASSWORD_HASHERS=['django.contrib.auth.hashers.CryptPasswordHasher'])
def test_crypt(self):
@ -177,6 +191,23 @@ class TestUtilsHashPass(SimpleTestCase):
self.assertTrue(check_password('', blank_encoded))
self.assertFalse(check_password(' ', blank_encoded))
@skipUnless(crypt, 'no crypt module to generate password.')
@override_settings(PASSWORD_HASHERS=['django.contrib.auth.hashers.CryptPasswordHasher'])
def test_crypt_encode_invalid_salt(self):
hasher = get_hasher('crypt')
msg = 'salt must be of length 2.'
with self.assertRaisesMessage(ValueError, msg):
hasher.encode('password', salt='a')
@skipUnless(crypt, 'no crypt module to generate password.')
@override_settings(PASSWORD_HASHERS=['django.contrib.auth.hashers.CryptPasswordHasher'])
def test_crypt_encode_invalid_hash(self):
hasher = get_hasher('crypt')
msg = 'hash must be provided.'
with mock.patch('crypt.crypt', return_value=None):
with self.assertRaisesMessage(TypeError, msg):
hasher.encode('password', salt='ab')
@skipUnless(bcrypt, "bcrypt not installed")
def test_bcrypt_sha256(self):
encoded = make_password('lètmein', hasher='bcrypt_sha256')